SCADA network diagrams

Identifies documents containing references to scada network diagrams in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: structural regex with domain-specific anchors and constrained context replaces phrase-only marker.
Detection quality: Topic verified
Jurisdictions: global
Regulations: AML/CTF Act (Cth), HRIPA (Cth), IPA 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), TIA Act 1979 (Cth)
Frameworks: ISO 27001, ISO 27701
Data categories: infrastructure, security
Scope: wide
Risk rating: 9
Platform compatibility: Purview: Compatible, GCP DLP: Unsupported, Macie: Unsupported, Zscaler: Compatible, Palo Alto: Unsupported, Netskope: Unsupported

Pattern

(?is)\b(?:scada\s+network\s+diagram|supervisory\s+control\s+and\s+data\s+acquisition|remote\s+terminal\s+unit|industrial\s+control\s+system|OT\s+network|ICS\s+network\s+topology)\b(?=[\s\S]{0,150}?\b(?:Modbus|DNP3|OPC[-\s]?UA|HMI|RTU|PLC|DCS|VLAN|Purdue\s+(?:Model|level)|firewall\s+zone|\d{1,3}(?:\.\d{1,3}){3}(?:/\d{1,2})?)\b)

Corroborative evidence keywords

scada, network diagram, critical infrastructure, Modbus, Modbus TCP, Modbus RTU, DNP3, OPC-UA, [object Object], [object Object], [object Object], [object Object], VLAN, Purdue Model, subnet, firewall zone, air gap, OT network, tag database, I/O map (+15 more)

Proximity: 300 characters

Should match

SCADA network diagram showing HMI, RTU-12, and PLC-04 connected via Modbus TCP on VLAN 30 (10.10.30.0/24)
Industrial control system topology diagram with DNP3 links between the DCS and remote terminal units

Should not match

Corporate IT network diagram showing office switches, routers, and firewall for the finance department
A cybersecurity awareness training slide explains what a SCADA network diagram is, with no actual diagram attached
unrelated generic text without domain phrases
placeholder value 12345

Known false positives

Common words and phrases related to scada network diagrams appearing in policy documents, training materials, HR templates, or compliance guidelines without actual personal data. Mitigation: Require corroborative evidence keywords within the proximity window to confirm sensitive data context rather than general discussion.
In Australian English, similar terminology used in formal or administrative contexts (education, professional documentation) that does not constitute sensitive data collection. Mitigation: Layer with additional contextual signals such as structured identifiers, form fields, or database column headers to distinguish sensitive records from general references.
High-frequency pattern matches in large document corpora due to broad regex anchors. Expected match rate is significantly higher than specific identifier patterns. Mitigation: Tune confidence thresholds for bulk scanning. Consider using this pattern primarily as a pre-filter with secondary validation.

References

https://www.legislation.gov.au/C2018A00029/latest/text
https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism